Set up Okta single sign-on for Eklo

This guide connects Eklo to Okta with SAML 2.0, so people at your church's email domain sign in to Eklo through Okta.

Read Single sign-on (SAML) first. You need a verified email domain in Eklo and an Okta admin account.

1. Create the app in OktaCopy Anchor Link

1. In the Okta Admin Console, go to Applications → Applications and click Create App Integration.

2. Choose SAML 2.0 and click Next.

3. App name: Eklo. Under App visibility, tick Do not display application icon to users. Eklo only accepts sign-in that starts on the Eklo sign-in page, so a dashboard tile wouldn't work. Click Next.

4. Under SAML Settings, copy from Eklo's Settings → Single sign-on:

   • Single sign-on URL: Eklo's ACS URL. Leave Use this for Recipient URL and Destination URL ticked.
   • Audience URI (SP Entity ID): Eklo's Entity ID.
   • Name ID format: EmailAddress.
   • Application username: Email.

5. Under Attribute Statements, add:

   Name	Value
   email	user.email
   givenName	user.firstName
   surname	user.lastName

   With these names you can leave Eklo's attribute fields blank.

6. Click Next, choose I'm an Okta customer adding an internal app, and click Finish.

Okta signs the assertion by default; keep it that way.

2. Assign peopleCopy Anchor Link

On the app's Assignments tab, assign the people or groups who should use Eklo. Only assigned people can sign in.

3. Connect Eklo to OktaCopy Anchor Link

1. On the app's Sign On tab, copy the Metadata URL.
2. In Eklo, open Settings → Single sign-on, choose Metadata URL, paste it, and click Save connection.

Eklo shows Okta's entity ID (http://www.okta.com/…), sign-in URL and certificate expiry.

4. TestCopy Anchor Link

In a private window, go to the Eklo sign-in page, enter your work email and choose Continue with single sign-on. Okta asks you to sign in, then sends you back to Eklo.

When it works for you, consider turning on Require SSO for the domain. See Require SSO.

Certificate rotationCopy Anchor Link

When Okta rotates the app's signing certificate, open the connection in Eklo, click Update connection, and save again with the same metadata URL.